I know when a Mail server receives an e-mail, it performs a "DNS 3 way check" (I think this is also sometimes called FCrDNS) as a simply test against spammers. The way I understand it to work is as follows:

Starting with the Source IP of the incoming mail (taken from the actual IP Packet):

  1. Reverse Lookup the PTR for the Source IP -- this results in a Domain Name
  2. Forward Lookup the Domain Name from #1 -- this results in an IP Address
  3. The SourceIP of the incoming mail must match the IP Address resulted in #2.

There is sometimes an additional check of the SMTP Helo Banner, which is in the format of the domain name. Do a forward lookup on the Domain Name, that results in an IP Address. Then do a reverse Lookup of the PTR of the IP address, and that should resolve back to the same Domain Name in the SMTP DNS records above are set.

But what if you have 30 mail servers, all sharing 3 different IPs. How do you set the SMTP Banner, A Records, and PTR records to pass all the tests above? Assume there is no way for the 30 mail servers to know what IP address they are getting on the outside. Each new TCP connection could theoretically come from a different Public IP.

My best guess, is you would have to set this up:

mailer.eddie.com     IN     A
mailer.eddie.com     IN     A
mailer.eddie.com     IN     A   IN     PTR     mailer.eddie.com   IN     PTR     mailer.eddie.com   IN     PTR     mailer.eddie.com

SMTP Banner for each server:  mailer.eddie.com

But would that cause any other issues with 30 mail servers sharing the exact same SMTP banner? And how would the Forward Look up (step 2 of 3 above) be affected if looking up the domain returns 3 different IP addresses?

To summarize, this is really a question that has three main tenants to be spoken to:
(1) Confirm the operation of the DNS/SMTP Three-Way check.
(2) Confirm the solution functionality for multiple servers behind one public IP.
(3) Confirm and Elaborate on the functionality of multiple servers behind multiple, non-static, Public IP addresses.

1 Answer 1


Your NAT scenario "Assume there is no way for the 30 mail servers to know what IP address they are getting on the outside" is broken in the context of reliable SMTP delivery.

It's quite simple. A reverse DNS record can only reliable map back to one host-name. I.e. will only map to smtp1.example.com.

The same holds for the A-record: smtp1.example.com. should only point to one ip-address otherwise you get a round-robin DNS where one lookup will show a different ip-address from the second.

(The recipient gets the incoming connection from identified as smtp1.example.com and performs a DNS lookup that returns an A-record --> Mismatch and thus extra spam score.)

That makes a simple rule: a mail-server should only use 1 single IP-address as the primary.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .